CVE-2026-86540 knowns before 0.30.0 Arbitrary Code Execution via LSP Binary

knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binar...

CVE-2026-86540

Knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files. An attacker who crafts a malicious .knowns/config.json file in a repository can cause the unvalidated binary path to be executed twice under the user's account with no verificati...